High Performance Networks - Compilation and Optimization of Protocol Analyzers

In times when critical national infrastructure depends more than ever on digital networks, the prevention of cyber attacks, as opposed to reacting after security has been compromised, becomes a chief concern. Intrusion Detection and Prevention (IDP) systems serve an indispensable role in proactively preserving the integrity of computer networks under cyber attacks. However, two independent trends are driving IDP solutions to a breaking point: (1) typical pattern-matching IDP solutions deploy low-coverage signatures that can be easily bypassed by new classes of exploits; and (2) as network data rates increase, IDP boxes are overwhelmed by the quantity of computation they must perform to secure the system. This project will explore the use of a new signature generation framework that produces protocol-aware polymorphic-proof signatures with larger coverage. In addition, a novel protocol compiler perspective will be developed to enable the rapid mapping of signature and protocol specifications onto hardware. Phase I identified the core reason leading to the IDP breaking point: lack of protocol-awareness limits the coverage of signatures and makes polymorphic attacks a powerful weapon for bypassing existing security measures. Phase II will use a theoretical and practical framework to implement a commercial-ready high-performance IDP solution based on our compiler approach.Commercial Applications and other Benefits as described by the awardee: High-speed, protocol-aware intrusion detection systems should be useful to organizations (companies, governments, utilities, armed forces, and even individuals) whose valuable assets make them targets of sophisticated cyber attackers. Security and cost savings benefits would accrue when assets are better and more efficiently protected, and commercial enterprises can secure their business operations more effectively and cheaply